.png)
Free mobile app risk assessment
See what ships inside your build.
Upload one Android or iOS build. In about 5 minutes, see every library, SDK and AI model inside it, where your users' data goes, and whether Google Play or the App Store is likely to reject it.
-
What's inside itEvery library, SDK and AI model, with known vulnerabilities and outdated versions. Software Composition Analysis (SCA).
-
Where your users' data goesTrackers, risky permissions, personal data in the binary and servers in high-risk regions. Privacy Shield.
-
Whether the store will accept itBlockers and warnings against Google Play and App Store policy, with how to fix each one. Store Release Readiness.
Assess your app
Results in about 5 minutes. We'll email the full report.
Trusted by enterprise teams worldwide
How it works
From one build to a full risk report in your inbox.
Upload one build
Your name, company and work email, plus the .apk, .aab or .ipa you want to check. No source code, no repository access.
See your risk summary
Your top risks show on screen, with the evidence behind them.
Get your full report, free
Every finding with its fix, sent to your work email.
Who runs it
One build, three teams that need the answer.
Know every component before your auditor asks
Customers and regulators are asking what's inside your app, and the EU Cyber Resilience Act will require an SBOM from December 2027. Our SCA gives you a CycloneDX SBOM and AI SBOM of the build you actually ship.
Catch store rejections before review
See the policy blockers in each version of your app before you release it, while there's still time to fix them, not after Google Play or the App Store sends it back.
Prove where user data goes
Every tracker, permission and destination region in one map, for your GDPR, DPDP or app store data safety answers.
What the risk assessment shows you
Most of your app wasn't written by your team. Here's what came with it.
SDKs, analytics trackers and AI models ship inside every release. You won't see them in your source code. You'll see them in the build.
Every library, SDK and AI model you ship
The known vulnerabilities in each, which ones are out of date, and the ones your developers never added directly. Export it as a CycloneDX SBOM for your auditor.
Software Composition Analysis (SCA)Every tracker and server address in your build
Risky permissions, personal data exposed in the binary, and connections to high-risk regions, with the SDK responsible for each.
Privacy ShieldYour odds of rejection, before you hit submit
Checked against Google Play and App Store policy, with the blockers behind it and how to fix each one, so a rejection doesn't cost you a release.
Store Release ReadinessSample results, for illustration. Download the full sample report (PDF)
Your build, handled like ours
What happens to your app after you upload it.
The questions your security team will ask before anyone uploads a release build. Answered up front.
- Static analysis onlyThe free assessment reads the compiled app. It never runs it, and needs no source code or repository access.
- Deleted after 7 daysYour build and results are removed automatically after 7 days.
- Never sharedYour app and your details are never shared with third parties.
- Audited every yearAppknox is SOC 2 Type II and ISO 27001 certified, in the cloud and on-prem.
Beyond the free risk assessment
The free assessment is one build, once. Appknox customers get every build, every store.
Vulnerability assessment with KnoxIQ
Binary SAST, Agentic DAST on real Android and iOS devices, and API security testing on every build. KnoxIQ Agent validates every finding, ranks it by exploit likelihood and writes the fix.
Penetration testing
Expert-led tests auditors accept, plus AI pen testing on every release, for the business-logic flaws automated scans miss.
Storeknox and third-party app risk
Discovery, drift detection and agentic fake app detection across app stores after release, plus risk ratings for the apps that sit beside your data.
Also on the platform: CI/CD integrations, a CISO dashboard across all your apps, and reports mapped to 12 standards, from OWASP MASVS to PCI DSS, DORA and SAMA.
Before you upload.
Can't find your answer? Ask our security team.
Is the mobile app risk assessment really free?
Yes. The risk summary and the full report are both free. No credit card needed.
What do you need from me?
One build: an .apk or .aab for Android, or an .ipa for iOS, up to 500 MB. No source code and no access to your repositories.
What does the free assessment look at?
Three things: the third-party libraries, SDKs and AI models inside your app (software composition analysis, or SCA), where your users' data goes (Privacy Shield), and whether Google Play or the App Store is likely to reject the build (Store Release Readiness).
Does it find vulnerabilities in my own code?
No. The free assessment covers what ships with your app, not the code your team wrote. Paid plans add Binary SAST, Agentic DAST on real Android and iOS devices, API security testing and penetration testing.
What happens to my build?
It's deleted after 7 days and never shared with third parties. Appknox is SOC 2 Type II and ISO 27001 certified.
Can I get an SBOM for my Android or iOS app?
Yes. Our software composition analysis (SCA) produces a CycloneDX SBOM of every library and SDK in the build, plus an AI SBOM of the models and AI services it uses. Both come with your full reports.
How do I get my full report?
We email it to the work email you entered, once the scan finishes. If you'd like to talk through your results or see what a paid plan would find, you can book a demo whenever you're ready.
How is this different from a paid plan?
The free assessment reads one build, once. Paid plans assess every build from your pipeline, validate and rank findings with KnoxIQ, add pen tests by our experts, and watch the app stores after release. Compare plans
See the report before you send us a build.
Not ready to upload a build? Download the sample report and see exactly what you'll get for your own app: every finding, every fix and every data flow.
- All 49 risks in Fintrail Wallet, with the fix for each
- Privacy data map: trackers, regions and the SDK behind each
- Google Play and App Store blockers, step by step
